VYPR
← All advisories
High severityNVD Advisory· Published Aug 17, 2021· Updated Aug 4, 2024

Improper Handling of Unexpected Data Type in ced

CVE-2021-39131

Description

ced detects character encoding using Google’s compact_enc_det library. In ced v0.1.0, passing data types other than Buffer causes the Node.js process to crash. The problem has been patched in ced v1.0.0. As a workaround, before passing an argument to ced, verify it’s a Buffer using Buffer.isBuffer(obj).

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cednpm
< 1.0.01.0.0

Affected products

1

Patches

1
a4d9f10b6bf1

Throw TypeError if argument is not a buffer

https://github.com/sonicdoe/cedJakob KrigovskyJul 22, 2018via ghsa
commit
2 files changed · +10 −0
  • index.js+4 −0 modified
    @@ -3,5 +3,9 @@
 const bindings = require('bindings')('ced.node')
 
 module.exports = buf => {
+  if (!Buffer.isBuffer(buf)) {
+    throw new TypeError('Expected a buffer')
+  }
+
   return bindings.detectEncoding(buf)
 }
  • test.js+6 −0 modified
    @@ -10,3 +10,9 @@ test('detects ASCII', t => {
   const buf = Buffer.from('tést', 'ascii')
   t.is(ced(buf), 'ASCII')
 })
+
+test('throws a TypeError if the argument is not a buffer', t => {
+  t.throws(() => {
+    ced('tést')
+  }, TypeError)
+})

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.